Refactor GeoTIFF Phase 5d: extract _cog_http.py from _reader.py (PR-J of #2211)

[brendancol]

Summary

Follow-up under epic #2211. Phase 5d deliverable: extract the COG-over-HTTP transport layer out of _reader.py into a new _cog_http.py. After PR-E/G/H, COG-HTTP is the only multi-hundred-line cluster left in _reader.py.

Scope

Mechanical extraction. Behavior-neutral.

Files

• Create: xrspatial/geotiff/_cog_http.py.
• Modify: xrspatial/geotiff/_reader.py — remove the helpers being moved; import them from _cog_http.
• Modify: any module that imports the COG-HTTP helpers (likely _backends/dask.py, _backends/vrt.py).

What to move

COG-over-HTTP transport helpers in _reader.py (verify each name in the current file; line numbers may have shifted):

• _parse_cog_http_meta
• _read_cog_http
• _fetch_decode_cog_http_strips
• _fetch_decode_cog_http_tiles

Leave in _reader.py: _read_to_array (top-level orchestrator) and any post-PR-H residue.

Acceptance

• _reader.py line count drops below ~500. Rough target: ~840 lines move.
• All COG-HTTP tests pass unchanged: test_cog_http_*.py, test_http_cog_coalesce.py, test_cog_*.py, test_cog_overview_*.py, plus the broader geotiff suite.
• Public import paths preserved (from xrspatial.geotiff import ...).
• No public API change.
• The _HTTPSource monkeypatch path used by test_http_cog_coalesce.py must continue to work. The test patches _reader._HTTPSource and calls _reader._read_cog_http. After extraction, the patched attribute must still be what _read_cog_http sees, so consider either keeping _HTTPSource looked up through the _reader module namespace (re-exported from _sources) or updating the test to patch _cog_http._HTTPSource. Document the choice in the PR description.

Non-goals

• Splitting the fetch/decode functions further (e.g. into _cog_http_strips.py / _cog_http_tiles.py) — leave as one module.
• Performance work.

Closes part of #2211.